fix: handle OCI digest algorithm prefix in chart downloader by banjoh · Pull Request #31601 · helm/helm

banjoh · 2025-12-03T13:49:59Z

What this PR does / why we need it:

OCI references with tag+digest (e.g., chart:1.0@sha256:abc...) failed with "invalid byte" error because the sha256: prefix was passed to hex.DecodeString().

Closed: #31600

Special notes for your reviewer:

If applicable:

this PR contains user facing changes (the docs needed label should be applied if so)
this PR contains unit tests
this PR has been tested for backwards compatibility

OCI references with tag+digest (e.g., chart:1.0@sha256:abc...) failed with "invalid byte" error because the sha256: prefix was passed to hex.DecodeString(). Signed-off-by: Evans Mungai <mbuevans@gmail.com>

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

TerryHowe · 2025-12-03T20:31:43Z

Thanks for pulling to PR together so fast @banjoh !

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

TerryHowe

/lgtm

gjenkins8 · 2025-12-22T21:08:23Z

+			if result != tt.expected {
+				t.Errorf("stripDigestAlgorithm(%q) = %q, want %q", tt.input, result, tt.expected)
+			}


Suggested change

if result != tt.expected {

t.Errorf("stripDigestAlgorithm(%q) = %q, want %q", tt.input, result, tt.expected)

}

assert.Equal(t, tt.expected, result)

Use testify?

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

…onsistency

Copilot

Pull request overview

Fixes Helm’s OCI chart download path for references that include both a tag and a digest (e.g., chart:1.0@sha256:...) by ensuring the digest algorithm prefix isn’t passed into hex.DecodeString().

Changes:

Normalize digest strings by stripping the <algo>: prefix before hex decoding in ChartDownloader.
Add a small helper + unit test for digest-prefix stripping.
Add an end-to-end regression test for helm pull with tag@digest, and adjust OCI test server helper to return the pushed digest.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/repo/v1/repotest/server.go	Changes OCI test server helper to return pushed-chart metadata for tests.
pkg/downloader/chart_downloader.go	Strips digest algorithm prefix before hex decoding in download/cache paths.
pkg/downloader/chart_downloader_test.go	Adds unit test coverage for digest-prefix stripping helper.
pkg/cmd/pull_test.go	Adds regression test for pulling OCI charts with tag+digest.

Comments suppressed due to low confidence (3)

pkg/downloader/chart_downloader.go:134

After decoding the digest, the code copies it into a fixed [32]byte buffer without validating the decoded length. If a non-SHA256 digest ever comes through (or any digest not exactly 32 bytes), this will silently truncate/pad and can lead to incorrect cache keys and potential collisions. Consider validating that the decoded digest is exactly sha256.Size bytes (and/or that any algorithm prefix is specifically sha256) before copying into digest32.

	var digest []byte
	var digest32 [32]byte
	if hash != "" {
		// if there is a hash, populate the other formats
		// Strip the algorithm prefix (e.g., "sha256:") if present
		digest, err = hex.DecodeString(stripDigestAlgorithm(hash))
		if err != nil {
			return "", nil, err
		}
		copy(digest32[:], digest)
		if pth, err := c.Cache.Get(digest32, CacheChart); err == nil {

pkg/downloader/chart_downloader.go:242

Same issue as in DownloadTo: the decoded digest is copied into a fixed [32]byte buffer without checking the decoded length. This can silently truncate/pad non-32-byte digests and produce wrong cache keys; validate len(digest) == sha256.Size (or verify the algorithm prefix is sha256) before copying.

	// Strip the algorithm prefix (e.g., "sha256:") if present
	digest, err := hex.DecodeString(stripDigestAlgorithm(digestString))
	if err != nil {
		return "", nil, fmt.Errorf("unable to decode digest: %w", err)
	}
	var digest32 [32]byte
	copy(digest32[:], digest)

pkg/cmd/pull_test.go:551

This strips the digest algorithm prefix using a fixed substring offset ([7:]), which assumes the digest always starts with sha256: and is long enough. Prefer parsing on : (e.g., via strings.Cut/SplitN) so the test is robust to digest algorithm/format changes and avoids a potential out-of-range panic if the digest string is unexpected.

		digestPart := result.PushedChart.Manifest.Digest[7:] // strip "sha256:"
		expectedFile = filepath.Join(outdir, fmt.Sprintf("oci-dependent-chart@sha256-%s.tgz", digestPart))

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-19T18:22:03Z

+func (srv *OCIServer) Run(t *testing.T, opts ...OCIServerOpt) *OCIServerRunResult {
 	t.Helper()


Changing OCIServer.Run to return a value is a breaking API change for this test helper: any existing call sites that previously did ociSrv.Run(t) will now fail to compile unless they use/ignore the returned value. Either update all call sites in this repo to handle the return value, or keep Run as void and introduce a separate method (e.g., RunWithResult) for callers that need the push digest/result.

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

TerryHowe

/lgtm

…elm#31601)

* fix: strip digest algorithm prefix before hex decoding OCI references with tag+digest (e.g., chart:1.0@sha256:abc...) failed with "invalid byte" error because the sha256: prefix was passed to hex.DecodeString(). Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Add cmd test for OCI references with tag+digest Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Move oci registry push result to a struct Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Review comments from PR review Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Fix failing test Signed-off-by: Evans Mungai <mbuevans@gmail.com> --------- Signed-off-by: Evans Mungai <mbuevans@gmail.com> (cherry picked from commit ee01860)

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [aqua:helm/helm](https://github.com/helm/helm) | minor | `3.20.0` → `3.21.4` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>helm/helm (aqua:helm/helm)</summary> ### [`v3.21.4`](https://github.com/helm/helm/releases/tag/v3.21.4): Helm v3.21.4 [Compare Source](helm/helm@v3.21.3...v3.21.4) Helm v3.21.4 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom-lfx.platform.linuxfoundation.org/meeting/91295593969?password=17825db5-c698-44cc-9f00-ef1f61f5d3fb) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Notable Changes - fix(engine): prevent Files.Lines panic on empty file (backport to v3)- [#32303](helm/helm#32303) by [@mahesh-sadupalli](https://github.com/mahesh-sadupalli) - fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932- [#32463](helm/helm#32463) by [@karan-vk](https://github.com/karan-vk) - \[dev-v3 backport] fix: bump go.opentelemetry.io/otel\@v1.44.0 for GO-2026-5158- [#32535](helm/helm#32535) by [@scottrigby](https://github.com/scottrigby) - \[dev-v3 backport] deps: bump google.golang.org/grpc\@v1.82.1 for GO-2026-6061- [#32536](helm/helm#32536) by [@scottrigby](https://github.com/scottrigby) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0- (includes golang.org/x/text v0.40.0 to fix GO-2026-5970) [#32308](helm/helm#32308) #### Installation and Upgrading Download Helm v3.21.4. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.21.4-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-darwin-amd64.tar.gz.sha256sum) / 9173d05edf9592c6be1d0412ffafd935448dfc7a63c2bc732b8c67e55503e8a8) - [MacOS arm64](https://get.helm.sh/helm-v3.21.4-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-darwin-arm64.tar.gz.sha256sum) / 6e0bf5eb6daafc2b1ec34bb5ba04ef103f3afc16192fb19805c2924d7ea1033f) - [Linux amd64](https://get.helm.sh/helm-v3.21.4-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-amd64.tar.gz.sha256sum) / 61f88ab166748cb19604d7884cb100ae9ccb13804ddeb98e08af167eacbb6a14) - [Linux arm](https://get.helm.sh/helm-v3.21.4-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-arm.tar.gz.sha256sum) / b02709eab565cfcee8acdb10c143daf05ab06d994baeb85e63976513367925a7) - [Linux arm64](https://get.helm.sh/helm-v3.21.4-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-arm64.tar.gz.sha256sum) / b54c04b4e0b2540bbdc08c17a121dab70e9a2ed0de5705528fec68a5fd3b85a7) - [Linux i386](https://get.helm.sh/helm-v3.21.4-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-386.tar.gz.sha256sum) / 71280742be811c7d9d6b4546125f185ba01c6fd967e47491766b0055a0570cf5) - [Linux ppc64le](https://get.helm.sh/helm-v3.21.4-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-ppc64le.tar.gz.sha256sum) / ba4e4f440b6992f119160e3ceea29d80158546c9241748332ffa1cfdfbb0bd8f) - [Linux s390x](https://get.helm.sh/helm-v3.21.4-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-s390x.tar.gz.sha256sum) / 321de1ff6fe57a9a5eca6b56d78d6959babe295ec7aab49af1a0d2bcfc02dfc8) - [Linux riscv64](https://get.helm.sh/helm-v3.21.4-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.4-linux-riscv64.tar.gz.sha256sum) / fef3ec7e1ddafe8927253ad79f2f8e3ac41f3f92328eb2c23bd4513b4421e5d9) - [Windows amd64](https://get.helm.sh/helm-v3.21.4-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.21.4-windows-amd64.zip.sha256sum) / 268a7b98b313403055e4f31807aeaac529c90e1188acd7857ae3e960b0f67cce) - [Windows arm64](https://get.helm.sh/helm-v3.21.4-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.21.4-windows-arm64.zip.sha256sum) / e23545fff21ef04853a9540925dd73c4b9caaa24ee7fdd8482b1ee626a4eecc9) This release was signed with `208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155` and can be found at [@scottrigby](https://github.com/scottrigby) [keybase account](https://keybase.io/r6by). Please use the attached signatures for verifying this release using `gpg`. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026 #### Changelog - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 ([#32308](helm/helm#32308)) [`813176c`](helm/helm@813176c) (dependabot\[bot]) - \[dev-v3 backport] deps: bump google.golang.org/grpc\@v1.82.1 for GO-2026-6061 [`b6aa8b1`](helm/helm@b6aa8b1) (Scott Rigby) - fix: bump go.opentelemetry.io/otel\@v1.44.0 for GO-2026-5158 [`57ce7ae`](helm/helm@57ce7ae) (Scott Rigby) - fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 [`ab71449`](helm/helm@ab71449) (Karan V) - fix(engine): prevent Files.Lines panic on empty file [`955dfab`](helm/helm@955dfab) (Mahesh Sadupalli) **Full Changelog**: <helm/helm@v3.21.3...v3.21.4> ### [`v3.21.3`](https://github.com/helm/helm/releases/tag/v3.21.3): Helm v3.21.3 [Compare Source](helm/helm@v3.21.2...v3.21.3) Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Installation and Upgrading Download Helm v3.21.3. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.21.3-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-darwin-amd64.tar.gz.sha256sum) / 76d0db4730b05d3d625eee11e80f0721b32b4d8422f4e5d093de6337bf3ac9f8) - [MacOS arm64](https://get.helm.sh/helm-v3.21.3-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-darwin-arm64.tar.gz.sha256sum) / 19879a848cad832b7a1ac24b767a481d20fb3b95ab53a220849649422ada144e) - [Linux amd64](https://get.helm.sh/helm-v3.21.3-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-amd64.tar.gz.sha256sum) / 15e041a93a590dce8100f39385cd98c84a765c9e36aeeb9e2dc6ff9e4769e2e0) - [Linux arm](https://get.helm.sh/helm-v3.21.3-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-arm.tar.gz.sha256sum) / 60f3106ba5e24371af51574fccf489d382d2f59c56ce566d02f2a6f00bf4fb3b) - [Linux arm64](https://get.helm.sh/helm-v3.21.3-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-arm64.tar.gz.sha256sum) / 67f58155079ff9ffab98ba5c88daff0ed9b542f3a4732f5dd426dde7dd0f5244) - [Linux i386](https://get.helm.sh/helm-v3.21.3-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-386.tar.gz.sha256sum) / 95e7ef76d4631f30e3f6c17d4355420878ca85771dbe7deb7b797521007aebe4) - [Linux ppc64le](https://get.helm.sh/helm-v3.21.3-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-ppc64le.tar.gz.sha256sum) / c8657c0f77b7d3e2f9508c4a9a545b5862d01690f2a528fbbe659a3a4d534382) - [Linux s390x](https://get.helm.sh/helm-v3.21.3-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-s390x.tar.gz.sha256sum) / d6c2dd29b32da1cb9dfef5af0cb93a1f391beca4e714779186330681b39f4b59) - [Linux riscv64](https://get.helm.sh/helm-v3.21.3-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.3-linux-riscv64.tar.gz.sha256sum) / ff063cc304a60af858242aa71b5635852d65aa7d3301a46eca17a31c54e8d994) - [Windows amd64](https://get.helm.sh/helm-v3.21.3-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.21.3-windows-amd64.zip.sha256sum) / ff490897e07e976c65a9bd7690cfc139b35ba5e8f25d00eaf1e53a30f1ad3f62) - [Windows arm64](https://get.helm.sh/helm-v3.21.3-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.21.3-windows-arm64.zip.sha256sum) / 1d409b98f99a38704ccb3f0917cbad2417ed53f75751902b6bd84447803b69a9) The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026 - 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026 #### Changelog - Apply suggestions from code review [`1ad6e68`](helm/helm@1ad6e68) (Benoit Tigeot) - fix: drop containerd v1 dep to resolve govulncheck CVEs [`037733e`](helm/helm@037733e) (Benoit Tigeot) - chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 [`d3e178b`](helm/helm@d3e178b) (dependabot\[bot]) ### [`v3.21.2`](https://github.com/helm/helm/releases/tag/v3.21.2): Helm v3.21.2 [Compare Source](helm/helm@v3.21.1...v3.21.2) Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Notable Changes - Update Kubernetes client libraries to v1.36 #### Installation and Upgrading Download Helm v3.21.2. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.21.2-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-darwin-amd64.tar.gz.sha256sum) / 82ac9105e657267cb029b5bf27ed28e35db104777328a036a84d345046f9f329) - [MacOS arm64](https://get.helm.sh/helm-v3.21.2-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-darwin-arm64.tar.gz.sha256sum) / aea537342b4c03cf58e089cb8dc99468087bb1a0218531df40462faca3f6c5d3) - [Linux amd64](https://get.helm.sh/helm-v3.21.2-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-amd64.tar.gz.sha256sum) / 0a745198de24545d0055cd8414bc8d2ba10363ef5f5d38369ea1b399671cc083) - [Linux arm](https://get.helm.sh/helm-v3.21.2-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-arm.tar.gz.sha256sum) / d6c5ea4a0c0d8b68a525caa4fe969c5db5627365c66dc2878fe72ac1d6325f15) - [Linux arm64](https://get.helm.sh/helm-v3.21.2-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-arm64.tar.gz.sha256sum) / bbd559fc0547f1d96ccbc68fe4f1cb98f01808f36538139e669369066b781267) - [Linux i386](https://get.helm.sh/helm-v3.21.2-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-386.tar.gz.sha256sum) / 4f1d9f68c884cc143fc768d583c32cf23317713fc1e8ccbf309bb1d1ddafa15f) - [Linux ppc64le](https://get.helm.sh/helm-v3.21.2-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-ppc64le.tar.gz.sha256sum) / 8f0e57e13260e0c0008fec80629b560dc8891281ba3f0cd5d57895b8a5f76d8e) - [Linux s390x](https://get.helm.sh/helm-v3.21.2-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-s390x.tar.gz.sha256sum) / daf652ddbf37d5e896187d1ccc1f2868df8f261c1af5b5f2f1639022623aeefb) - [Linux riscv64](https://get.helm.sh/helm-v3.21.2-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.2-linux-riscv64.tar.gz.sha256sum) / 9e4dbd48868bf92835dd0de11387b1d82636330740b8943064da233b12791964) - [Windows amd64](https://get.helm.sh/helm-v3.21.2-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.21.2-windows-amd64.zip.sha256sum) / 5f346e3338617e9fd1b8c216065383061bdb3bde26cb6b3abc8ce0481354a513) - [Windows arm64](https://get.helm.sh/helm-v3.21.2-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.21.2-windows-arm64.zip.sha256sum) / e77859867482549e5613255605e7680bc72b308ea62b91ecc4626ed4ba116670) This release was signed by [@gjenkins8](https://github.com/gjenkins8) with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at <https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739>. Please use the attached signatures for verifying this release using gpg. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 3.21.3 will contain only bug fixes. - 3.22.0 is the next (and final) Helm 3 feature release #### Changelog - chore(deps): bump the k8s-io group with 2 updates [`1259634`](helm/helm@1259634) (dependabot\[bot]) - fixes [`b52e276`](helm/helm@b52e276) (Matheus Pimenta) - chore(deps): bump the k8s-io group across 1 directory with 2 updates [`3342dbf`](helm/helm@3342dbf) (dependabot\[bot]) **Full Changelog**: <helm/helm@v3.21.1...v3.21.2> ### [`v3.21.1`](https://github.com/helm/helm/releases/tag/v3.21.1): Helm v3.21.1 [Compare Source](helm/helm@v3.21.0...v3.21.1) Helm v3.21.1 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Notable Changes - Fixed nil pointer panic that could happen with helm template in ClientOnly flows. Now correctly returns a template error [#31920](helm/helm#31920) - Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 [#32152](helm/helm#32152) - Bumped Go from 1.25 to 1.26 [#32168](helm/helm#32168) - Dependency version updates #### Installation and Upgrading Download Helm v3.21.1. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.21.1-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-darwin-amd64.tar.gz.sha256sum) / dd353172bc8cef8c1845501043b82224520a79ff8b2cd4388ec5bfa060ce96b9) - [MacOS arm64](https://get.helm.sh/helm-v3.21.1-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-darwin-arm64.tar.gz.sha256sum) / 779ac09ad0cf333b12402555a32bd26174462384aba2f5a3845876f45d34146a) - [Linux amd64](https://get.helm.sh/helm-v3.21.1-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-amd64.tar.gz.sha256sum) / a349c62d6ab2d5d11f044fc0d3afa6deed7d27cc7d5c351f536b169d9fc2cc1a) - [Linux arm](https://get.helm.sh/helm-v3.21.1-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-arm.tar.gz.sha256sum) / ae52acbd13d1efa0d787aa679519da813c114c1b29b68e09a781fe258fc5c696) - [Linux arm64](https://get.helm.sh/helm-v3.21.1-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-arm64.tar.gz.sha256sum) / 9b3deeecb56c4795aa806858fa4d6388c049e3edfcd771723bd12c1cbef66893) - [Linux i386](https://get.helm.sh/helm-v3.21.1-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-386.tar.gz.sha256sum) / 1901a40be004699a2ac2cf05874bd84dfbed1f791327a0bc65c351d537b0f139) - [Linux ppc64le](https://get.helm.sh/helm-v3.21.1-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-ppc64le.tar.gz.sha256sum) / 136daecc0f4650158b2adedf14f29022402d92fd111041e55b4038c3df97c3bb) - [Linux s390x](https://get.helm.sh/helm-v3.21.1-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-s390x.tar.gz.sha256sum) / e5601b71342cba12ffd504c03c710769134fbec5bbdea6c90c859506e54d7591) - [Linux riscv64](https://get.helm.sh/helm-v3.21.1-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.1-linux-riscv64.tar.gz.sha256sum) / e22b20fe16f6bd0d9729034ae76a9e81708bd94b0aa9628f617dc3dfbe876a2b) - [Windows amd64](https://get.helm.sh/helm-v3.21.1-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.21.1-windows-amd64.zip.sha256sum) / e9d0dbeac9c9923c1b444ac4a1fc8e59d9f9afbeb30b4b6e9a00ac60a45b9459) - [Windows arm64](https://get.helm.sh/helm-v3.21.1-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.21.1-windows-arm64.zip.sha256sum) / 9b8b803b27a5c1bdcbc75bcf8d1bf45c8f2ffede8ae29bed3ec093746b9807f9) This release was signed with `208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155` and can be found at [@scottrigby](https://github.com/scottrigby) [keybase account](https://keybase.io/r6by). Please use the attached signatures for verifying this release using `gpg`. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026 - 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026 #### Changelog - fix(action): avoid nil REST client getter panic when installing CRDs [`c56dd00`](helm/helm@c56dd00) (sergiochan) - fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1 [`702529f`](helm/helm@702529f) (Terry Howe) - chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 [`178e120`](helm/helm@178e120) (dependabot\[bot]) - chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 [`dcf35f8`](helm/helm@dcf35f8) (dependabot\[bot]) - chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 [`44aff8b`](helm/helm@44aff8b) (dependabot\[bot]) - chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 [`ae2f31f`](helm/helm@ae2f31f) (dependabot\[bot]) - Update .github/env [`402225f`](helm/helm@402225f) (Terry Howe) - ci: bump golangci-lint to v2.11.3 for go 1.26 [`00eac21`](helm/helm@00eac21) (Terry Howe) - chore: bump go to 1.26 [`bec346a`](helm/helm@bec346a) (Terry Howe) - chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3 [`58b6ccf`](helm/helm@58b6ccf) (dependabot\[bot]) - chore(deps): bump github.com/distribution/distribution/v3 [`30b9f51`](helm/helm@30b9f51) (dependabot\[bot]) - chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 [`858aa47`](helm/helm@858aa47) (dependabot\[bot]) - chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 [`1af25d4`](helm/helm@1af25d4) (dependabot\[bot]) - chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 [`97e4bc3`](helm/helm@97e4bc3) (dependabot\[bot]) - chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 [`29bdd1b`](helm/helm@29bdd1b) (dependabot\[bot]) - fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 [`bad6cd4`](helm/helm@bad6cd4) (Terry Howe) - chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0 [`75c2e9b`](helm/helm@75c2e9b) (dependabot\[bot]) - chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0 [`cd4dac3`](helm/helm@cd4dac3) (dependabot\[bot]) **Full Changelog**: <helm/helm@v3.21.0...v3.21.1> ### [`v3.21.0`](https://github.com/helm/helm/releases/tag/v3.21.0): Helm v3.21.0 [Compare Source](helm/helm@v3.20.2...v3.21.0) Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience. > \[!WARNING] > Helm v3 is approaching end-of-life. Please update to Helm v4. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Notable Changes - Kubernetes client libraries to v1.36 - notable changes here #### Installation and Upgrading Download Helm v3.21.0. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.21.0-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-darwin-amd64.tar.gz.sha256sum) / 8bc0c1f85f8738cc3cda4a2cc73047145bcdcb1f4d9cdcc29073037bfb22fa2e) - [MacOS arm64](https://get.helm.sh/helm-v3.21.0-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-darwin-arm64.tar.gz.sha256sum) / 68bfbdc022c543a2a022597b20298216877e98abe6e4a345d3ecf114d79cae5f) - [Linux amd64](https://get.helm.sh/helm-v3.21.0-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-amd64.tar.gz.sha256sum) / 0093eb572e3d2380f094df162ddb525e219249de88957afe24cfbb19632acd36) - [Linux arm](https://get.helm.sh/helm-v3.21.0-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-arm.tar.gz.sha256sum) / d310ac387324538a37192e8e13628eb1def2596bbac6b6481ae20d8d5e3532bd) - [Linux arm64](https://get.helm.sh/helm-v3.21.0-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-arm64.tar.gz.sha256sum) / 8de5a0c9a47431e59fd560e91e0779c8cf9316c383da7efb84128a4c339ecb2d) - [Linux i386](https://get.helm.sh/helm-v3.21.0-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-386.tar.gz.sha256sum) / fc85f14c9ce7e6a48a2b19a97edbc5529ed7aa2bc10f3d2c241e1c2ef12ccd22) - [Linux ppc64le](https://get.helm.sh/helm-v3.21.0-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-ppc64le.tar.gz.sha256sum) / e2dced0f903acda417f879012c7e09ca461000e26a04e8f7a1cfe0dcf495f62c) - [Linux s390x](https://get.helm.sh/helm-v3.21.0-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-s390x.tar.gz.sha256sum) / a176d7460a615b8df5b1a58ecf09fcc731c7733ca4cf10116cf198575b0371b5) - [Linux riscv64](https://get.helm.sh/helm-v3.21.0-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.21.0-linux-riscv64.tar.gz.sha256sum) / 4935c95c55bc5c3357143698a87185e17a39de9b6148dfd6cce0fc11859dbfeb) - [Windows amd64](https://get.helm.sh/helm-v3.21.0-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.21.0-windows-amd64.zip.sha256sum) / 3ea6b8383e6c0b7ce45d06a5746313b8e9225edd88d42f4f64582ff3792d7b55) - [Windows arm64](https://get.helm.sh/helm-v3.21.0-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.21.0-windows-arm64.zip.sha256sum) / 90d8c87e07267e6c71e678c9e33dd11cc121789c823ccc380de9d1dd521c8cba) This release was signed by [@gjenkins8](https://github.com/gjenkins8) with key `BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739`, which can be found at <https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739>. Please use the attached signatures for verifying this release using gpg. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 3.21.1 will contain only bug fixes. - 3.22.0 is the next feature release for Kubernetes v1.37 #### Changelog - \[v3] Bump to version v3.21 [`e0878d4`](helm/helm@e0878d4) (George Jenkins) - fix: upgrade opentelemetry packages to patch CVEs [`13d5fc4`](helm/helm@13d5fc4) (Terry Howe) - fix: Chart dot-name path bug [`2552884`](helm/helm@2552884) (George Jenkins) - fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow [`ec05dd5`](helm/helm@ec05dd5) (Terry Howe) - add image index test [`b0dfec5`](helm/helm@b0dfec5) (Pedro Tôrres) - fix pulling charts from OCI indices [`e629995`](helm/helm@e629995) (Pedro Tôrres) - chore(deps): bump the k8s-io group with 7 updates [`9c854fb`](helm/helm@9c854fb) (dependabot\[bot]) - chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 [`a692247`](helm/helm@a692247) (dependabot\[bot]) - chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 [`9f2a7f6`](helm/helm@9f2a7f6) (dependabot\[bot]) - chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 [`79f039b`](helm/helm@79f039b) (dependabot\[bot]) - chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 [`45210d5`](helm/helm@45210d5) (dependabot\[bot]) - Remove refactorring changes from coalesce\_test.go [`e2df39f`](helm/helm@e2df39f) (Evans Mungai) - Fix import [`97affe0`](helm/helm@97affe0) (Evans Mungai) - Update pkg/chart/common/util/coalesce\_test.go [`c264166`](helm/helm@c264166) (Evans Mungai) - Fix lint warning [`d409df8`](helm/helm@d409df8) (Evans Mungai) - Preserve nil values in chart already [`6fdd101`](helm/helm@6fdd101) (Evans Mungai) - fix(values): preserve nil values when chart default is empty map [`b13743c`](helm/helm@b13743c) (Evans Mungai) - chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 [`703999d`](helm/helm@703999d) (dependabot\[bot]) - chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 [`a04be96`](helm/helm@a04be96) (dependabot\[bot]) #### New Contributors - [@KrzysztofDziankowski](https://github.com/KrzysztofDziankowski) made their first contribution in [#31829](helm/helm#31829) **Full Changelog**: <helm/helm@v3.20.0...v3.21.0> ### [`v3.20.2`](https://github.com/helm/helm/releases/tag/v3.20.2): Helm v3.20.2 [Compare Source](helm/helm@v3.20.1...v3.20.2) #### v3.20.2 Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Security fixes - [GHSA-hr2v-4r36-88hr](GHSA-hr2v-4r36-88hr) Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment #### Installation and Upgrading Download Helm v3.20.2. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.20.2-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-darwin-amd64.tar.gz.sha256sum) / 7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618) - [MacOS arm64](https://get.helm.sh/helm-v3.20.2-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-darwin-arm64.tar.gz.sha256sum) / 139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d) - [Linux amd64](https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-amd64.tar.gz.sha256sum) / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea) - [Linux arm](https://get.helm.sh/helm-v3.20.2-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-arm.tar.gz.sha256sum) / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19) - [Linux arm64](https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-arm64.tar.gz.sha256sum) / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691) - [Linux i386](https://get.helm.sh/helm-v3.20.2-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-386.tar.gz.sha256sum) / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73) - [Linux ppc64le](https://get.helm.sh/helm-v3.20.2-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-ppc64le.tar.gz.sha256sum) / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe) - [Linux s390x](https://get.helm.sh/helm-v3.20.2-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-s390x.tar.gz.sha256sum) / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b) - [Linux riscv64](https://get.helm.sh/helm-v3.20.2-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.2-linux-riscv64.tar.gz.sha256sum) / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca) - [Windows amd64](https://get.helm.sh/helm-v3.20.2-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.20.2-windows-amd64.zip.sha256sum) / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454) - [Windows arm64](https://get.helm.sh/helm-v3.20.2-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.20.2-windows-arm64.zip.sha256sum) / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789) The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026 - 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026 #### Changelog - fix: Chart dot-name path bug [`8fb76d6`](helm/helm@8fb76d6) (George Jenkins) - fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow [`3a8927e`](helm/helm@3a8927e) (Terry Howe) ### [`v3.20.1`](https://github.com/helm/helm/releases/tag/v3.20.1): Helm v3.20.1 [Compare Source](helm/helm@v3.20.0...v3.20.1) Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Notable Changes - Backport of [#31644](helm/helm#31644): Fixed a bug where user-provided nil value was not preserved when chart has an empty map or no default for a key - Backport of [#31601](helm/helm#31601): Fixed a bug where OCI references with tag+digest failed with "invalid byte" error #### Installation and Upgrading Download Helm v3.20.1. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.20.1-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-darwin-amd64.tar.gz.sha256sum) / 580515b544d5c966edc6f782c9ae88e21a9e10c786a7d6c5fd4b52613f321076) - [MacOS arm64](https://get.helm.sh/helm-v3.20.1-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-darwin-arm64.tar.gz.sha256sum) / 75cc96ac3fe8b8b9928eb051e55698e98d1e026967b6bffe4f0f3c538a551b65) - [Linux amd64](https://get.helm.sh/helm-v3.20.1-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-amd64.tar.gz.sha256sum) / 0165ee4a2db012cc657381001e593e981f42aa5707acdd50658326790c9d0dc3) - [Linux arm](https://get.helm.sh/helm-v3.20.1-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-arm.tar.gz.sha256sum) / 758375df78fb8f91f4056244bda539710a73be79284b24b4bdad68384348ca33) - [Linux arm64](https://get.helm.sh/helm-v3.20.1-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-arm64.tar.gz.sha256sum) / 56b9d1b0e0efbb739be6e68a37860ace8ec9c7d3e6424e3b55d4c459bc3a0401) - [Linux i386](https://get.helm.sh/helm-v3.20.1-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-386.tar.gz.sha256sum) / 22b350307d5e5897b3a14f096cb6b2212cc03c22ba29ab7b4ee3e64ab9f3f190) - [Linux ppc64le](https://get.helm.sh/helm-v3.20.1-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-ppc64le.tar.gz.sha256sum) / 77b7d9bc62b209c044b873bc773055c5c0d17ef055e54c683f33209ebbe8883c) - [Linux s390x](https://get.helm.sh/helm-v3.20.1-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-s390x.tar.gz.sha256sum) / 3c43d45149a425c7bf15ba3653ddee13e7b1a4dd6d4534397b6f317f83c51b58) - [Linux riscv64](https://get.helm.sh/helm-v3.20.1-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.20.1-linux-riscv64.tar.gz.sha256sum) / 0eeae246112b4780e61651f9fbe6d778eebf8c8eccca590139b97d167d1b8aeb) - [Windows amd64](https://get.helm.sh/helm-v3.20.1-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.20.1-windows-amd64.zip.sha256sum) / 16d5256f4c2cde0745acb922ba88b7759dfced4bf547b99381084211f81c8629) - [Windows arm64](https://get.helm.sh/helm-v3.20.1-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.20.1-windows-arm64.zip.sha256sum) / 2aac2b87e92c32d44aa81c6412286d9db7e43b22b4c8ac112b68cf69185429bd) This release was signed with `208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155` and can be found at [@scottrigby](https://github.com/scottrigby) [keybase account](https://keybase.io/r6by). Please use the attached signatures for verifying this release using `gpg`. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 4.2.0 and 3.21.0 are the next minor releases and will be on May 13, 2026 - 4.1.4 and 3.20.2 are the next patch releases and will be on April 8, 2026 #### Changelog - chore(deps): bump the k8s-io group with 7 updates [`a2369ca`](helm/helm@a2369ca) (dependabot\[bot]) - add image index test [`90e1056`](helm/helm@90e1056) (Pedro Tôrres) - fix pulling charts from OCI indices [`911f2e9`](helm/helm@911f2e9) (Pedro Tôrres) - Remove refactorring changes from coalesce\_test.go [`76dad33`](helm/helm@76dad33) (Evans Mungai) - Fix import [`45c12f7`](helm/helm@45c12f7) (Evans Mungai) - Update pkg/chart/common/util/coalesce\_test.go [`26c6f19`](helm/helm@26c6f19) (Evans Mungai) - Fix lint warning [`09f5129`](helm/helm@09f5129) (Evans Mungai) - Preserve nil values in chart already [`417deb2`](helm/helm@417deb2) (Evans Mungai) - fix(values): preserve nil values when chart default is empty map [`5417bfa`](helm/helm@5417bfa) (Evans Mungai) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/358

pull-request-size Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Dec 3, 2025

banjoh changed the title ~~fix: strip digest algorithm prefix from digest string~~ fix: handle OCI digest algorithm prefix in chart downloader Dec 3, 2025

fix: strip digest algorithm prefix before hex decoding

c5112b9

OCI references with tag+digest (e.g., chart:1.0@sha256:abc...) failed with "invalid byte" error because the sha256: prefix was passed to hex.DecodeString(). Signed-off-by: Evans Mungai <mbuevans@gmail.com>

banjoh force-pushed the em/fix-digest-tag-inconsistency branch from a8697d7 to c5112b9 Compare December 3, 2025 13:52

Add cmd test for OCI references with tag+digest

9b34535

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

pull-request-size Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Dec 3, 2025

banjoh added the bug Categorizes issue or PR as related to a bug. label Dec 3, 2025

banjoh mentioned this pull request Dec 3, 2025

Inconsistent digest + tag handling in helm 4 install with OCI Chart #31600

Closed

TerryHowe reviewed Dec 3, 2025

View reviewed changes

Comment thread pkg/repo/v1/repotest/server.go Outdated

Move oci registry push result to a struct

10c4c25

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

TerryHowe previously approved these changes Dec 4, 2025

View reviewed changes

TerryHowe added the Has One Approval This PR has one approval. It still needs a second approval to be merged. label Dec 13, 2025

gjenkins8 reviewed Dec 22, 2025

View reviewed changes

Comment thread pkg/downloader/chart_downloader_test.go Outdated

Review comments from PR review

12bee37

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

banjoh dismissed TerryHowe’s stale review via 12bee37 January 7, 2026 13:32

Merge remote-tracking branch 'origin/main' into em/fix-digest-tag-inc…

2a23d1b

…onsistency

Copilot AI review requested due to automatic review settings February 19, 2026 18:17

Copilot started reviewing on behalf of banjoh February 19, 2026 18:17 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Fix failing test

88fdb7e

Signed-off-by: Evans Mungai <mbuevans@gmail.com>

TerryHowe approved these changes Feb 20, 2026

View reviewed changes

banjoh merged commit ee01860 into helm:main Feb 20, 2026
5 checks passed

banjoh deleted the em/fix-digest-tag-inconsistency branch February 20, 2026 16:58

mueslo added a commit to mueslo/helm that referenced this pull request Feb 23, 2026

fixup! fix: handle OCI digest algorithm prefix in chart downloader (h…

d57dd5b

…elm#31601)

scottrigby removed the Has One Approval This PR has one approval. It still needs a second approval to be merged. label Mar 10, 2026

scottrigby added this to the 4.1.2 milestone Mar 10, 2026

scottrigby added the needs-pick Indicates that a PR needs to be cherry-picked into the next release candidate. label Mar 10, 2026

scottrigby added picked Indicates that a PR has been cherry-picked into the next release candidate. and removed needs-pick Indicates that a PR needs to be cherry-picked into the next release candidate. labels Mar 11, 2026

scottrigby modified the milestones: 4.1.2, 4.1.3 Mar 11, 2026

Navigation Menu

Uh oh!

fix: handle OCI digest algorithm prefix in chart downloader - #31601

fix: handle OCI digest algorithm prefix in chart downloader#31601
banjoh merged 6 commits into
helm:mainfrom
banjoh:em/fix-digest-tag-inconsistency

banjoh commented Dec 3, 2025 •

edited

Loading

Uh oh!

Uh oh!

TerryHowe commented Dec 3, 2025

Uh oh!

TerryHowe left a comment

Uh oh!

gjenkins8 Dec 22, 2025

Uh oh!

banjoh Feb 20, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 19, 2026

Uh oh!

TerryHowe left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		func (srv OCIServer) Run(t testing.T, opts ...OCIServerOpt) *OCIServerRunResult {
		t.Helper()

Uh oh!

Conversation

banjoh commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

TerryHowe commented Dec 3, 2025

Uh oh!

TerryHowe left a comment

Choose a reason for hiding this comment

Uh oh!

gjenkins8 Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

banjoh Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

TerryHowe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

banjoh commented Dec 3, 2025 •

edited

Loading